Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27798

Merged
merged 1 commit into from Sep 4, 2023
Merged

bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27798

merged 1 commit into from Sep 4, 2023

Conversation

ti-mo
Copy link
Contributor

@ti-mo ti-mo commented Aug 29, 2023 •
edited

This patch adds a check to determine whether a Pod is sending traffic to itself through a Service. With endpoint routes enabled, this traffic is subject to policy, and we want to avoid the user to have to explicitly allow traffic to+from itself.

Fixes: #27709
Strictly depends on #27602 (for backports)

bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes

@ti-mo ti-mo requested a review from a team as a code owner August 29, 2023 12:42
@ti-mo ti-mo requested a review from aspsk August 29, 2023 12:42
@maintainer-s-little-helper maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Aug 29, 2023
@ti-mo ti-mo marked this pull request as draft August 29, 2023 12:42
@ti-mo ti-mo added the release-note/bug This PR fixes an issue in a previous release of Cilium. label Aug 29, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Aug 29, 2023
@ti-mo ti-mo added the sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. label Aug 29, 2023
@ti-mo ti-mo mentioned this pull request Aug 29, 2023
Closed
2 tasks
@ti-mo
Copy link
Contributor Author

ti-mo commented Aug 29, 2023

/test

qmonnet
qmonnet requested changes Aug 29, 2023
View reviewed changes
Copy link
Member

@qmonnet qmonnet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please find some minor comments below (even though I understand this is still a draft)

bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
sypakine
sypakine reviewed Aug 29, 2023
View reviewed changes
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
@sypakine sypakine mentioned this pull request Aug 29, 2023
Closed
2 tasks
julianwiedmann
julianwiedmann reviewed Aug 29, 2023
View reviewed changes
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
@julianwiedmann julianwiedmann added sig/policy Impacts whether traffic is allowed or denied based on user-defined policies. area/loadbalancing Impacts load-balancing and Kubernetes service implementations labels Aug 30, 2023
@ti-mo ti-mo force-pushed the tb/svc-hairpinning branch 2 times, most recently from e07938e to b465e93 Compare August 30, 2023 08:39
qmonnet
qmonnet reviewed Aug 30, 2023
View reviewed changes
bpf/bpf_lxc.c Outdated Show resolved Hide resolved
@ti-mo ti-mo force-pushed the tb/svc-hairpinning branch 2 times, most recently from 100ec9e to b08c03f Compare August 30, 2023 11:09
@ti-mo ti-mo mentioned this pull request Aug 30, 2023
Closed
@ti-mo
Copy link
Contributor Author

ti-mo commented Aug 30, 2023

/test

@ti-mo ti-mo added needs-backport/1.12 needs-backport/1.13 This PR / issue needs backporting to the v1.13 branch needs-backport/1.14 This PR / issue needs backporting to the v1.14 branch labels Aug 30, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot added this to Needs backport from main in 1.13.7 Aug 30, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot added this to Needs backport from main in 1.14.2 Aug 30, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot added this to Needs backport from main in 1.12.14 Aug 30, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot moved this from Backport pending to v1.13 to Needs backport from main in 1.13.7 Sep 7, 2023
@qmonnet qmonnet mentioned this pull request Sep 7, 2023
Merged
2 tasks
@qmonnet qmonnet added backport-pending/1.13 The backport for Cilium 1.13.x for this PR is in progress. and removed needs-backport/1.13 This PR / issue needs backporting to the v1.13 branch labels Sep 7, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot moved this from Needs backport from main to Backport pending to v1.13 in 1.13.7 Sep 7, 2023
@julianwiedmann julianwiedmann added backport-done/1.13 The backport for Cilium 1.13.x for this PR is done. and removed backport-pending/1.13 The backport for Cilium 1.13.x for this PR is in progress. labels Sep 8, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot moved this from Backport pending to v1.13 to Backport done to v1.13 in 1.13.7 Sep 8, 2023
@qmonnet qmonnet added backport-done/1.12 The backport for Cilium 1.12.x for this PR is done. and removed backport-pending/1.12 labels Sep 8, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot moved this from Backport pending to v1.12 to Backport done to v1.12 in 1.12.14 Sep 8, 2023
@michi-covalent michi-covalent added this to Needs backport from main in 1.14.3 Sep 9, 2023
@michi-covalent michi-covalent removed this from Needs backport from main in 1.14.2 Sep 9, 2023
This was referenced Sep 9, 2023
Merged
Merged
@ti-mo ti-mo deleted the tb/svc-hairpinning branch September 11, 2023 12:14
@gandro
Copy link
Member

gandro commented Sep 12, 2023 •
edited

@qmonnet @ti-mo This also needs a custom backport to v1.14 due to conflicts unfortunately

@gandro gandro added the backport/author The backport will be carried out by the author of the PR. label Sep 12, 2023
@gandro gandro mentioned this pull request Sep 12, 2023
Merged
15 tasks
@qmonnet
Copy link
Member

qmonnet commented Sep 12, 2023

OK thank you I will look into it

@qmonnet qmonnet mentioned this pull request Sep 12, 2023
Merged
1 task
@julianwiedmann julianwiedmann added backport-done/1.14 The backport for Cilium 1.14.x for this PR is done. and removed needs-backport/1.14 This PR / issue needs backporting to the v1.14 branch labels Sep 13, 2023
@qmonnet qmonnet mentioned this pull request Sep 28, 2023
Closed
@peterbosalliandercom peterbosalliandercom mentioned this pull request Sep 28, 2023
Closed
2 tasks
@jrajahalme jrajahalme moved this from Needs backport from main to Backport done to v1.14 in 1.14.3 Oct 18, 2023
@jrajahalme jrajahalme mentioned this pull request Oct 18, 2023
Merged
@lucasfcnunes lucasfcnunes mentioned this pull request Oct 19, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sypakine sypakine sypakine left review comments

@qmonnet qmonnet qmonnet approved these changes

@aspsk aspsk aspsk approved these changes

@julianwiedmann julianwiedmann julianwiedmann approved these changes

Assignees
No one assigned
Labels
area/loadbalancing Impacts load-balancing and Kubernetes service implementations backport/author The backport will be carried out by the author of the PR. backport-done/1.12 The backport for Cilium 1.12.x for this PR is done. backport-done/1.13 The backport for Cilium 1.13.x for this PR is done. backport-done/1.14 The backport for Cilium 1.14.x for this PR is done. kind/bug This is a bug in the Cilium logic. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/bug This PR fixes an issue in a previous release of Cilium. sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. sig/policy Impacts whether traffic is allowed or denied based on user-defined policies.
Projects
No open projects
1.12.14
Backport done to v1.12
1.13.7
Backport done to v1.13
1.14.3
Backport done to v1.14
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

IPv4 Service hairpin return-traffic denied by ingress policy
9 participants
@ti-mo @qmonnet @aditighag @brb @gandro @aspsk @sypakine @julianwiedmann @jibi